flex-auth/workplans/FLEX-WP-0032-informed-decision-list-action.md

---
id: FLEX-WP-0032
type: workplan
title: "Admit a list action for the informed-decision overview without handing the scope to the consumer"
domain: infotech
repo: flex-auth
status: proposed
flavor: implementation
owner: claude
topic_slug: netkingdom
planning_priority: P1
planning_order: 320
related_workplans:
  - FLEX-WP-0027
  - FLEX-WP-0028
created: "2026-09-21"
updated: "2026-09-21"
state_hub_workstream_id: "ab21b09f-2cb5-5d31-866d-11f02f13f3d8"
---

# FLEX-WP-0032 — `list` for the informed-decision decision overview

Opened from informed-decision intake `INFD-IN-0008` (`INFD-WP-0004-T02`), hub
message `a7b9ef3b-f95c-4c50-bfc5-7628d16881f6`. Full request:
`informed-decision/docs/flex-auth-request-list-action.md` @ `98c8de0`.

## What is asked

A new action, `list`, on `decision-memo` resources of system
`informed-decision`: the same identity bar as `read` **minus the 900-second MFA
freshness window**, over the memos of **both** admitted packages, shipped as v3
of `informed-decision.compact-sitting`. A `list` allow shows only memo id,
version and question, the live approval status, and the person's own responses.
It never shows brief or packet and never enables an act. `read` and every act
stay as in v2.

## Why the request is sound in principle

Looking back at your own outcomes is a different act from binding a new one, and
should not need binding-grade freshness. That holds on its own, **independent of
the KeyCape defect** that exposed it (`INFD-IN-0005`: KeyCape copies the previous
session's MFA timestamp even after an actual MFA, so `at` understates freshness).
The bug is key-cape's to fix; `read` is **not** loosened to work around it.
Loosening a binding bar to compensate for a claim defect would be the PDP
silently absorbing an identity-layer fault.

## What the PDP checks today — verified

The v2 sitting rule (`examples/informed-decision-sitting/policy.md:76`) scopes a
decision with three things: exact-record pinning (memo id → approval id and
binding digest), group `net-kingdom-admins`, and fresh AAL2 MFA. It does **not**
check that the memo is addressed to the subject. Recipient scoping today comes
from the operator's admission and the consumer's structural match.

## The two scope options

- **(A) resource-type-wide.** Any `decision-memo` of `informed-decision` in
  `tenant:platform`. Removes exact-record pinning for `list` — and together with
  the dropped freshness window, removes **both** PDP-side scopes at once. The
  only thing between a group member and every memo's question and status would
  be consumer code; flex-auth would record `allow` for memos never admitted by
  anyone and not addressed to the subject. The consumer's own document says its
  structural match "is not an entitlement". A PDP cannot rest an allow on a check
  the consumer disclaims.
- **(B) exact-record union.** The eight sitting records plus the three T03
  records, pinned by approval id and binding digest as today. The PDP keeps its
  own scope. Costs a package version per sitting — which is the property, not
  the cost: a new memo becomes listable when someone admitted it.

Recommendation: **(B)**.

## Open decisions (operator)

1. **Scope** — (A) or (B). Recommended (B), for the reason above.
2. **Freshness for `list`** — unbounded as asked, a longer bounded window, or
   decline. Unbounded means an MFA of any age satisfies `list` as long as the
   consumer presents a key-cape session; the PDP would state no bound at all.

Both are operator decisions by precedent: the reviewer identity bar on this
surface was admitted by the operator (`FLEX-WP-0027-T01`, `FLEX-WP-0028`).

## 1. Record the decision

```task
id: FLEX-WP-0032-T01
status: wait
priority: high
state_hub_task_id: "f741d47e-50b9-5eb1-81d9-ffec847be77a"
```

Owner: operator decides; `flex-auth` records as a `FLEX-DEC`.

## 2. Compile compact-sitting v3

```task
id: FLEX-WP-0032-T02
status: todo
priority: high
state_hub_task_id: "a24fc5cf-f663-5338-97da-169af7fb47fb"
```

Owner: `flex-auth`.

- New `list` rule; `read` and all five acts byte-identical in effect to v2.
- Under (B), per-record `memo_version`: the three T03 records are at version 2
  (`f85479c`), the sitting records at 1. The v2 rule's global
  `memo_version == 1` cannot be reused for the union.
- `list` never satisfies any act: a separate rule, not an extra action in the
  existing allow set.
- A version bump, per `FLEX-DEC-2026-008`: a widened bar must be visible to the
  consumer as a version change.

## 3. Fixtures and the exercise receipt

```task
id: FLEX-WP-0032-T03
status: todo
priority: high
state_hub_task_id: "984f11f4-6ec9-5f7d-840b-4dee2e121212"
```

Owner: `flex-auth`, with informed-decision's fixtures.

At minimum: stale MFA allowed for `list`, refused for `read`; no group refused;
agent refused; `principal_type_source` other than `authentication-derived`
refused; under (B), an unlisted memo refused and each T03 record listable at
version 2 only. Every v2 check must still pass unchanged — the existing 147
sitting checks and T03's 57.

Gate: `flex-auth validate`, `test-policy`, and the exercise scripts green; a
receipt in `docs/evidence/`.

## 4. Publish and hand back

```task
id: FLEX-WP-0032-T04
status: todo
priority: medium
state_hub_task_id: "2a296df6-1d39-5b3e-9312-8e791a6ccbd0"
```

Owner: `flex-auth` publishes the package, version and digest; informed-decision
updates its admission input. **Deploying the pin is a production change to a
live human-review surface and is confirmed with the operator before it runs.**